# CVE-2026-126209: Loofah allowed_uri? XSS bypass via numeric character reference

Source: https://junglewise.ai/threats/cve-2026-126209-loofah-is-a-general-library-for-manipulating-and-transforming  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-126209 · Severity: medium · Published 2026-11-12

Loofah is a library for sanitizing HTML/XML documents used by Rails and other web applications. The allowed_uri? function fails to properly detect JavaScript and VBScript URLs when they are obfuscated with specific HTML character references, allowing attackers to inject malicious links that bypass security checks and execute arbitrary JavaScript in a user's browser.

Technologies: [Loofah](https://junglewise.ai/threats/technologies/loofah-loofah), [loofah (RubyGems)](https://junglewise.ai/threats/technologies/loofah). Vendors: [Loofah](https://junglewise.ai/threats/vendors/loofah), [Rails](https://junglewise.ai/threats/vendors/rails), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-126209 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126209 being exploited in the wild.

**How severe is CVE-2026-126209?** Medium severity, published 12 November 2026.

**Which products and versions are affected?** Loofah 2.25.0 to 2.25.2; Rails-Html-Sanitizer affected versions; loofah (RubyGems) >= 2.25.0, < 2.25.3.

**Is there a fix for CVE-2026-126209?** Yes: fixed in Loofah 2.25.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126209 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126209?** Check whether you run Loofah, Rails-Html-Sanitizer or loofah (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Loofah 2.25.3

## Technical details

The vulnerability exists in Loofah's allowed_uri? function (and by extension Rails::HTML::Sanitizer.allowed_uri?), which strips whitespace and control characters before decoding numeric character references. This allows an attacker to craft URIs like "javascript&#x3a; alert(1)" where a stripped character terminates a semicolon-less numeric reference, causing the function to decode a longer reference and miss the javascript: scheme. A browser processes character references before stripping, revealing the actual scheme. The fix reorders decoding to occur before stripping, matching browser behavior. Loofah's default sanitize() path is unaffected as Nokogiri decodes entities first.

## Affected products

- Loofah Loofah 2.25.0 to 2.25.2
- Rails Rails::HTML::Sanitizer affected versions

## Identifiers

- CVE-2026-126209
- GHSA-p9wj-w8xq-vjx6

## Timeline

- 2026-11-12: disclosed
- 2026-11-02: patched: Fix merged in PR #324

## References

- [https://github.com/flavorjones/loofah/commit/62c04841e8252a1b5373afcd2b89fb9b8279e317](https://github.com/flavorjones/loofah/commit/62c04841e8252a1b5373afcd2b89fb9b8279e317)
- [https://github.com/flavorjones/loofah/pull/324](https://github.com/flavorjones/loofah/pull/324)

## Related threats

- [Loofah SVG href sanitization bypass in textPath and mpath](https://junglewise.ai/threats/cve-2026-126208-loofah-is-a-general-library-for-manipulating-and-transforming)
- [Loofah CSS url() sanitization bypass via escaped parentheses](https://junglewise.ai/threats/cve-2026-126207-loofah-css-url-sanitization-bypass-via-escaped-parentheses)
- [Loofah HTML5 Scrub XSS bypass via HTML entity encoding in data URIs](https://junglewise.ai/threats/cve-2026-126206-loofah-allowed-uri-treats-data-text-sol-html-as-safe-text-plain)
- [Loofah regular expression denial of service in SVG local-reference check](https://junglewise.ai/threats/cve-2026-126205-loofah-regular-expression-denial-of-service-in-the-svg-local)
- [Loofah HTML5 scrubber markup injection with Nokogiri](https://junglewise.ai/threats/cve-2026-126203-loofah-is-a-general-library-for-manipulating-and-transforming)